Closed danirabbit closed 3 years ago
Similar to the appstream-compose, it was based a referenced manifest.
network access for clips to retrieve basic info on URLs like below. it tries to get a page title.
--share=network
for storing cache files
read-only access to get installed apps and app icons, since clips uses app name matching to know what app a content was copied from
keyring access for setting password for clips protection
I've updated the permissions with comments https://github.com/hezral/clips/commit/482a543e79e0f02f9face28f2212637b81768741
Confirmed working with latest build https://github.com/hezral/clips/actions/runs/1174143451
Will submit a new release
That makes sense for the network! Thanks for adding comments for some of the other filesystem lines, that helps a lot
You might want to double check the cache and keying permissions. I'm fairly certain that you shouldn't need access to the system for either of those features. I believe secrets and cache will be stored inside the sandbox, like gsettings
Thanks, confirmed cahce permission isn't required. Confirmed with https://github.com/hezral/clips/actions/runs/1176132494
But for the keyring it is needed and i don't see it in the .var/app/
the keyring access is to store a password to protect contents. i didn't want to reinvent anything so i opted to use the keyring.
Closed with release in AppCenter
While reviewing your app, I noticed that the flatpak sandbox permissions here seem pretty aggressive. Can you explain why your app needs:
all these filesystem permissions?
Access to the keyring?
GPU access?
Network access?